---
type: api
title: Search cases
description: You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-findcasesdefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-findcasesdefaultspace
products:
  - Kibana
---

# Search cases

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/cases/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

## Query String Parameters

- `assignees` (union string | [] string)
  Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.
  One of: `string` or `string[]`
- `category` (union string | [] string)
  Filters the returned cases by category.
  One of: `string` or `string[]`
- `defaultSearchOperator` (string · default: OR)
  he default operator to use for the simple_query_string.
- `from` (string)
  Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.
- `owner` (union oneOf)
  A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.
  Values: `cases`, `observability`, `securitySolution`
- `page` (integer · default: 1)
  The page number to return.
- `perPage` (integer · max: 100 · default: 20)
  The number of items to return. Limited to 100 items.
- `reporters` (union string | [] string)
  Filters the returned cases by the user name of the reporter.
  One of: `string` or `string[]`
- `search` (string)
  An Elasticsearch simple_query_string query that filters the objects in the response.
- `searchFields` (union oneOf)
  The fields to perform the simple_query_string parsed query against.
  Values: `description`, `title`
- `severity` (enum)
  The severity of the case.
  Values: `critical`, `high`, `low`, `medium`
- `sortField` (enum  · default: createdAt)
  Determines which field is used to sort the results.
  Values: `createdAt`, `updatedAt`, `closedAt`, `title`, `category`, `status`, `severity`
- `sortOrder` (enum  · default: desc)
  Determines the sort order.
  Values: `asc`, `desc`
- `status` (enum)
  Filters the returned cases by state.
  Values: `closed`, `in-progress`, `open`
- `tags` (union string | [] string)
  Filters the returned cases by tags.
  One of: `string` or `string[]`
- `to` (string)
  Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `cases` ([] object · max: 10000)
  - `assignees` ([] null · max: 10) — nullable
    An array containing users that are assigned to the case.
    - `uid` (string)
      A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
  - `category` (string) — nullable
    The case category.
  - `closed_at` (string) — nullable
  - `closed_by` ({}) — nullable
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
  - `comments` ([] union oneOf · max: 10000)
    An array of comment objects for the case.
    - **Cases_alert_comment_response_properties**
      - `alertId` ([] string)
      - `created_at` (string)
      - `created_by` (object)
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `id` (string)
      - `index` ([] string)
      - `owner` (enum)
        The application that owns the cases: Stack Management, Observability, or Elastic Security.
        Values: `cases`, `observability`, `securitySolution`
      - `pushed_at` (string) — nullable
      - `pushed_by` (object) — nullable
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `rule` (object)
        - `id` (string) — nullable
          The rule identifier.
        - `name` (string) — nullable
          The rule name.
      - `type` (enum)
        Values: `alert`
      - `updated_at` (string) — nullable
      - `updated_by` (object) — nullable
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `version` (string)
    - **Cases_event_comment_response_properties**
      - `created_at` (string)
      - `created_by` ({})
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `eventId` ([] string)
      - `id` (string)
      - `index` ([] string)
      - `owner` (enum)
        The application that owns the cases: Stack Management, Observability, or Elastic Security.
        Values: `cases`, `observability`, `securitySolution`
      - `pushed_at` (string) — nullable
      - `pushed_by` ({}) — nullable
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `type` (enum)
        Values: `event`
      - `updated_at` (string) — nullable
      - `updated_by` ({}) — nullable
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `version` (string)
    - **Cases_user_comment_response_properties**
      - `comment` (string)
      - `created_at` (string)
      - `created_by` ({})
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `id` (string)
      - `owner` (enum)
        The application that owns the cases: Stack Management, Observability, or Elastic Security.
        Values: `cases`, `observability`, `securitySolution`
      - `pushed_at` (string) — nullable
      - `pushed_by` ({}) — nullable
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `type` (enum)
        Values: `user`
      - `updated_at` (string) — nullable
      - `updated_by` ({}) — nullable
        - `email` (string) — nullable
        - `full_name` (string) — nullable
        - `profile_uid` (string)
        - `username` (string) — nullable
      - `version` (string)
  - `connector` (union oneOf)
    - **Cases_connector_properties_none** (`type: .none`)
      Defines properties for connectors when type is `.none`.
      - `fields` (string) — nullable
        An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
      - `id` (string)
        The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
      - `name` (string)
        The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
      - `type` (enum)
        The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.
        Values: `.none`
    - **Cases_connector_properties_cases_webhook** (`type: .cases-webhook`)
      Defines properties for connectors when type is `.cases-webhook`.
      - `fields` (string) — nullable
      - `id` (string)
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string)
        The name of the connector.
      - `type` (enum)
        The type of connector.
        Values: `.cases-webhook`
    - **Cases_connector_properties_jira** (`type: .jira`)
      Defines properties for connectors when type is `.jira`.
      - `fields` (object)
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `issueType` (string) — nullable
          The type of issue.
        - `parent` (string) — nullable
          The key of the parent issue, when the issue type is sub-task.
        - `priority` (string) — nullable
          The priority of the issue.
      - `id` (string)
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string)
        The name of the connector.
      - `type` (enum)
        The type of connector.
        Values: `.jira`
    - **Cases_connector_properties_resilient** (`type: .resilient`)
      Defines properties for connectors when type is `.resilient`.
      - `fields` (object) — nullable
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `issueTypes` ([] string)
          The type of incident.
        - `severityCode` (string)
          The severity code of the incident.
      - `id` (string)
        The identifier for the connector.
      - `name` (string)
        The name of the connector.
      - `type` (enum)
        The type of connector.
        Values: `.resilient`
    - **Cases_connector_properties_servicenow** (`type: .servicenow`)
      Defines properties for connectors when type is `.servicenow`.
      - `fields` (object)
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `category` (string) — nullable
          The category of the incident.
        - `impact` (string) — nullable
          The effect an incident had on business.
        - `severity` (string) — nullable
          The severity of the incident.
        - `subcategory` (string) — nullable
          The subcategory of the incident.
        - `urgency` (string) — nullable
          The extent to which the incident resolution can be delayed.
      - `id` (string)
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string)
        The name of the connector.
      - `type` (enum)
        The type of connector.
        Values: `.servicenow`
    - **Cases_connector_properties_servicenow_sir** (`type: .servicenow-sir`)
      Defines properties for connectors when type is `.servicenow-sir`.
      - `fields` (object)
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `category` (string) — nullable
          The category of the incident.
        - `destIp` (boolean) — nullable
          Indicates whether cases will send a comma-separated list of destination IPs.
        - `malwareHash` (boolean) — nullable
          Indicates whether cases will send a comma-separated list of malware hashes.
        - `malwareUrl` (boolean) — nullable
          Indicates whether cases will send a comma-separated list of malware URLs.
        - `priority` (string) — nullable
          The priority of the issue.
        - `sourceIp` (boolean) — nullable
          Indicates whether cases will send a comma-separated list of source IPs.
        - `subcategory` (string) — nullable
          The subcategory of the incident.
      - `id` (string)
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string)
        The name of the connector.
      - `type` (enum)
        The type of connector.
        Values: `.servicenow-sir`
    - **Cases_connector_properties_swimlane** (`type: .swimlane`)
      Defines properties for connectors when type is `.swimlane`.
      - `fields` (object)
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `caseId` (string) — nullable
          The case identifier for Swimlane connectors.
      - `id` (string)
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string)
        The name of the connector.
      - `type` (enum)
        The type of connector.
        Values: `.swimlane`
  - `created_at` (string)
  - `created_by` ({})
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
  - `customFields` ([] object)
    Custom field values for the case.
    - `key` (string)
      The unique identifier for the custom field. The key value must exist in the case configuration settings.
    - `type` (enum)
      The custom field type. It must match the type specified in the case configuration settings.
      Values: `text`, `toggle`
    - `value` (union string | boolean) — nullable
      The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.
  - `description` (string)
  - `duration` (integer) — nullable
    The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
  - `extended_fields` (map string to string)
    The case's stored field values, keyed by storage key (for example `priority_as_keyword`).
  - `external_service` ({}) — nullable
    - `connector_id` (string)
    - `connector_name` (string)
    - `external_id` (string)
    - `external_title` (string)
    - `external_url` (string)
    - `pushed_at` (string)
    - `pushed_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
  - `id` (string)
  - `incremental_id` (integer) — nullable
    A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
  - `observables` ([] object)
    Observables attached to the case.
    - `createdAt` (string)
      When the observable was created.
    - `description` (string) — nullable
      An optional description for the observable.
    - `id` (string)
      The observable identifier.
    - `typeKey` (string)
      The observable type key.
    - `updatedAt` (string) — nullable
      When the observable was last updated.
    - `value` (string)
      The observable value.
  - `owner` (enum)
    The application that owns the cases: Stack Management, Observability, or Elastic Security.
    Values: `cases`, `observability`, `securitySolution`
  - `settings` ({})
    An object that contains the case settings.
    - `extractObservables` (boolean)
      When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
    - `syncAlerts` (boolean)
      Turns alert syncing on or off.
  - `severity` (enum)
    The severity of the case.
    Values: `critical`, `high`, `low`, `medium`
  - `status` (enum)
    The status of the case.
    Values: `closed`, `in-progress`, `open`
  - `tags` ([] string)
  - `title` (string)
  - `total_observables` (integer) — nullable
    The number of observables attached to the case.
  - `totalAlerts` (integer)
  - `totalComment` (integer)
  - `totalEvents` (integer)
    The number of events attached to the case.
  - `updated_at` (string) — nullable
  - `updated_by` ({}) — nullable
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
  - `version` (string)
- `count_closed_cases` (integer)
- `count_in_progress_cases` (integer)
- `count_open_cases` (integer)
- `page` (integer)
- `per_page` (integer)
- `total` (integer)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code Examples

#### Console

```console
GET /api/cases/_find
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/cases/_find"
```

## Response Examples

#### Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.

```json
{
  "cases": [
    {
      "assignees": [],
      "category": "null",
      "closed_at": "null",
      "closed_by": "null",
      "comments": [],
      "connector": {
        "fields": "null",
        "id": "none",
        "name": "none",
        "type": ".none"
      },
      "created_at": "2023-10-12T00:16:36.371Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "customFields": [
        {
          "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
          "type": "text",
          "value": "My field value"
        },
        {
          "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
          "type": "toggle",
          "value": "null"
        }
      ],
      "description": "Case description",
      "duration": "null",
      "external_service": "null",
      "id": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2",
      "incremental_id": 1,
      "observables": [],
      "owner": "cases",
      "settings": {
        "extractObservables": false,
        "syncAlerts": true
      },
      "severity": "low",
      "status": "open",
      "tags": [
        "tag-1"
      ],
      "title": "Case title",
      "total_observables": 0,
      "totalAlerts": 0,
      "totalComment": 1,
      "totalEvents": 0,
      "updated_at": "2023-10-12T00:27:58.162Z",
      "updated_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "version": "WzExMCwxXQ=="
    }
  ],
  "count_closed_cases": 0,
  "count_in_progress_cases": 0,
  "count_open_cases": 1,
  "page": 1,
  "per_page": 5,
  "total": 1
}
```

#### Authorization information is missing or invalid.

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```